thcrap_loader: fix 2 buffer overruns.

thpatch · Dec 29, 2019 · 113d1b2 · 113d1b2
1 parent d1d1d1c
commit 113d1b2
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 3 deletions.
diff --git a/thcrap_loader/src/loader.cpp b/thcrap_loader/src/loader.cpp
@@ -9,6 +9,8 @@
 
 #pragma comment(linker,"/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'\"")
 #include <thcrap.h>
+#include <string>
+#include <vector>
 #include <thcrap_update_wrapper.h>
 
 const char *EXE_HELP =
@@ -29,11 +31,11 @@ const char* game_lookup(const json_t *games_js, const char *game, const char *ba
 	const json_t *game_path = json_object_get(games_js, game);
 	if (!json_string_length(game_path)) {
 		game_missing = game;
-		return json_string_value(game_path);
+		return nullptr;
 	}
 	const char *game_path_str = json_string_value(game_path);
 	if (PathIsRelativeA(game_path_str)) {
-		char* ret = (char*)malloc(current_dir_len + strlen(game_path_str));
+		char* ret = (char*)malloc(strlen(base_dir) + strlen(game_path_str) + 1);
 		strcpy(ret, base_dir);
 		PathAppendA(ret, game_path_str);
 		return ret;
@@ -150,7 +152,7 @@ int __cdecl win32_utf8_main(int argc, const char *argv[])
 			}
 			if (PathIsRelativeU(arg)) {
 				if (strchr(arg, '\\')) {
-					run_cfg_fn = (char*)malloc(strlen(rel_start) + strlen(arg));
+					run_cfg_fn = (char*)malloc(strlen(rel_start) + strlen(arg) + 1);
 					strcpy(run_cfg_fn, rel_start);
 					strcat(run_cfg_fn, arg);
 				} else {

diff --git a/thcrap_update/src/loader_update.cpp b/thcrap_update/src/loader_update.cpp
@@ -11,6 +11,7 @@
 #include "update.h"
 #include "notify.h"
 #include "self.h"
+#include "loader_update.h"
 
 enum {
 	HWND_MAIN,

diff --git a/thcrap_update/src/loader_update.h b/thcrap_update/src/loader_update.h
@@ -11,9 +11,17 @@
 
 #include <thcrap.h>
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 // [game_id_fallback] is used to enforce updating this game's patch files in
 // case [exe_fn] can't be identified as a known game.
 // (Workaround for issue #69, https://github.com/thpatch/thcrap/issues/69,
 // covering the standard use case of thcrap_loader being started with
 // references to games.js IDs that are identical to those used in patches.)
 BOOL loader_update_with_UI(const char *exe_fn, char *args, const char *game_id_fallback);
+
+#ifdef __cplusplus
+}
+#endif